Leaving no backup for if the one Taylor has is lost or stolen.
That said, I was commenting on how that so-called "good security practice" backfired spectacularly on a number of companies in the Chicagoland area in 2020.
Taylor doesn't know where any of the others are. And even if she did, she probably wouldn't be able to get them.
Though, if she did somehow get her hands on one, she may or may not be able to reauthorize it.
She does, however, know that the other active unit was being badly misused, presumably by someone who wasn't supposed to have it.
Taylor changed the password on the one she has, so presumably it'd be harder for someone else to be able to use. Especially since the one she has seems to have a low level subsentient AI managing the security, as it was able to determine that Annette was dead and she was Annette's daughter. Presumably the systems responsible for that would also notice if someone stole and tried to use it.
Taylor not having a backup access method is potentially an issue. But I suspect that she (and Dragon) would consider the risk of nobody having access less of a concern than some random person finding one of the missing units and figuring out a way in.
--
That said, yeah, automatically locking out credentials after a month is an issue when things like the Covid lockdowns and quarantines happen. Though, to be fair, that's a not entirely unreasonable security measure under more normal conditions, where it can be reasonably be expected that things aren't normally going to be dormant for more than a few days at a time, unless something goes badly wrong, and people are going to be in the office most days.
On the other hand, since the in-story period of dormancy had been years, that's kind of a long time. Oh, sure, there are circumstances where leaving credentials valid even after that period of dormancy would be reasonable, but even there I'd expect that most of the time such long dormancy would result in downgrading the access levels and permissions of a given set of credentials.